CVE-2019-1653
Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
Description
CVE-2019-1653 is a HIGH-severity information disclosure vulnerability in Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers, carrying a CVSS 3.1 score of 7.5. The vulnerability exists due to improper access controls for URLs in the web-based management interface, allowing an unauthenticated remote attacker to retrieve sensitive information such as the router configuration or detailed diagnostic data. Affected products include Cisco RV320 firmware (1.4.2.15, 1.4.2.17) and Cisco RV325 firmware (1.4.2.15, 1.4.2.17). This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. The EPSS score of 0.94378 (99.97th percentile) reflects an extremely high real-world exploitation probability, demanding immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | rv320 firmware | 1.4.2.15; 1.4.2.17 |
| cisco | rv325 firmware | 1.4.2.15; 1.4.2.17 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- http://packetstormsecurity.com/files/152260/Cisco-RV320-Unauthenticated-Configuration-Export.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/152261/Cisco-RV320-Unauthenticated-Diagnostic-Data-Retrieval.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/152305/Cisco-RV320-RV325-Unauthenticated-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- http://seclists.org/fulldisclosure/2019/Mar/59(Exploit, Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2019/Mar/60(Exploit, Mailing List, Third Party Advisory)
- http://www.securityfocus.com/bid/106732(Third Party Advisory, VDB Entry)
- https://badpackets.net/over-9000-cisco-rv320-rv325-routers-vulnerable-to-cve-2019-1653/(Third Party Advisory)
- https://seclists.org/bugtraq/2019/Mar/53(Mailing List, Third Party Advisory)
- https://seclists.org/bugtraq/2019/Mar/54(Mailing List, Third Party Advisory)
- https://threatpost.com/scans-cisco-routers-code-execution/141218/(Third Party Advisory)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info(Vendor Advisory)
- https://www.exploit-db.com/exploits/46262/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/46655/(Third Party Advisory, VDB Entry)
- https://www.youtube.com/watch?v=bx0RQJDlGbY(Third Party Advisory)
- https://www.zdnet.com/article/hackers-are-going-after-cisco-rv320rv325-routers-using-a-new-exploit/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1653(US Government Resource)
Weakness Type
CWE-284: Improper Access Control
CVE-2019-1653 is classified under CWE-284 — Improper Access Control. This weakness occurs when software does not properly restrict access to a resource from an unauthorized actor. This is a broad category encompassing authentication bypass, authorization bypass, and improper enforcement of access policies. Access control involves determining who can access what resources and what actions they can perform.
In the context of Cisco Small Business RV320 and RV325 routers, the improper access control manifests as unprotected URL endpoints that expose configuration files and diagnostic data to unauthenticated users. Attackers can simply request specific URLs via HTTP or HTTPS to download the full router configuration, which typically contains administrative credentials, VPN secrets, and network topology information. Over 9,000 vulnerable routers were identified as exposed on the internet, making this a high-value target for mass exploitation campaigns.
Learn more: CWE-284 — Improper Access Control
Impact Analysis
CVE-2019-1653 carries a CVSS 3.1 score of 7.5 (HIGH) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation allows an attacker to download the complete router configuration, including administrative credentials, VPN pre-shared keys, network configuration details, and potentially credentials for connected services. This represents a total compromise of the device's confidentiality.
Integrity (NONE): This vulnerability does not directly allow modification of system files or configurations. However, credentials obtained through this information disclosure can be leveraged to achieve full administrative access.
Availability (NONE): The vulnerability does not directly impact the availability of the affected device. The router continues to operate normally during and after exploitation.
Scope Unchanged: The impact is contained within the vulnerable component. However, the exposed credentials and configuration data can serve as a pivot point for further attacks against the broader network.
With an EPSS score of 0.94378 (99.97th percentile), CVE-2019-1653 is among the most exploited vulnerabilities tracked, reflecting widespread automated scanning and exploitation activity.
Exploit Maturity
CVE-2019-1653 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: Multiple public exploits are available for this vulnerability, including entries on Exploit-DB and PacketStorm. The exploitation is trivial, requiring only a simple HTTP request to specific URLs on the management interface. Automated mass scanning for vulnerable devices has been widely documented.
Ransomware association: No direct ransomware association has been confirmed for CVE-2019-1653. However, the exposed credentials can facilitate lateral movement and deeper network compromise that may lead to ransomware deployment.
Attack surface: The vulnerability affects the web-based management interface, which is often exposed to the internet on small business routers. Over 9,000 vulnerable devices were identified online shortly after disclosure. Public exploit code makes exploitation accessible to low-skilled attackers.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03. All organizations using RV320 or RV325 routers should apply firmware updates immediately or restrict management interface access.
Remediation
- Apply firmware updates immediately. Apply updates per vendor instructions. Consult Cisco's security advisory (cisco-sa-20190123-rv-info) for specific firmware versions that address this vulnerability.
- Restrict management interface access. Ensure the web-based management interface is not accessible from the internet. Use firewall rules to limit access to trusted IP addresses only. Disable remote management if not strictly required.
- Rotate all credentials. After patching, immediately change all administrative passwords, VPN pre-shared keys, and any credentials stored in the router configuration. Assume all configuration data has been compromised.
- Audit for prior exploitation. Review access logs for requests to known exploit URLs. Check for unauthorized configuration changes or new admin accounts. Investigate any anomalous VPN connections.
- Implement network segmentation. Ensure that management interfaces for network devices are isolated on a dedicated management VLAN. Apply strict access controls to prevent unauthorized access from user or guest networks.
- Consider device replacement. The RV320 and RV325 are small business routers with limited security features. Evaluate whether a more current device with ongoing vendor support and better security capabilities would be appropriate for your environment.
Technical Details
CVE-2019-1653 is a HIGH-severity information disclosure vulnerability exploitable over the network with low attack complexity. No authentication or user interaction is required.
Technical mechanism: The web-based management interface of the Cisco RV320 and RV325 routers fails to properly enforce access controls on certain URL endpoints. An attacker can send crafted HTTP or HTTPS requests to these endpoints to retrieve the complete router configuration file or detailed diagnostic information without any authentication. The configuration file contains sensitive data including administrative credentials, VPN settings, SNMP community strings, and network topology details.
CVSS 3.1 vector analysis (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N): The network-based attack vector with no privileges required and no user interaction makes this vulnerability highly accessible to remote attackers. The impact is limited to confidentiality (HIGH) as the vulnerability enables information disclosure but not direct modification or disruption.
Affected products: Cisco RV320 firmware (versions 1.4.2.15 and 1.4.2.17) and Cisco RV325 firmware (versions 1.4.2.15 and 1.4.2.17). Both are Dual Gigabit WAN VPN Routers commonly deployed in small business environments.
Frequently Asked Questions
Is CVE-2019-1653 being actively exploited?
Yes, CVE-2019-1653 is actively exploited in the wild. Multiple public exploits exist, and mass scanning for vulnerable devices has been widely documented. The EPSS score of 0.94378 (99.97th percentile) confirms an extremely high real-world exploitation rate. The vulnerability is listed in CISA's KEV catalog.
What products are affected by CVE-2019-1653?
Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers with firmware versions 1.4.2.15 and 1.4.2.17 are affected. These routers are commonly deployed in small and medium business environments for VPN connectivity and internet access.
How do I fix CVE-2019-1653?
Apply firmware updates per Cisco's security advisory (cisco-sa-20190123-rv-info). Restrict management interface access to trusted networks only. After patching, rotate all credentials including admin passwords and VPN pre-shared keys, as these may have been exposed.
How severe is CVE-2019-1653?
CVE-2019-1653 is rated HIGH with a CVSS 3.1 score of 7.5. While only confidentiality is directly impacted, the exposed configuration data contains credentials that can lead to full device compromise. The EPSS score of 0.94378 (99.97th percentile) places it among the most exploited vulnerabilities tracked.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.